linux/fs/isofs
Hugh Dickins 35c2a7f490 tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking
Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),
	u64 inum = fid->raw[2];
which is unhelpfully reported as at the end of shmem_alloc_inode():

BUG: unable to handle kernel paging request at ffff880061cd3000
IP: [<ffffffff812190d0>] shmem_alloc_inode+0x40/0x40
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Call Trace:
 [<ffffffff81488649>] ? exportfs_decode_fh+0x79/0x2d0
 [<ffffffff812d77c3>] do_handle_open+0x163/0x2c0
 [<ffffffff812d792c>] sys_open_by_handle_at+0xc/0x10
 [<ffffffff83a5f3f8>] tracesys+0xe1/0xe6

Right, tmpfs is being stupid to access fid->raw[2] before validating that
fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may
fall at the end of a page, and the next page not be present.

But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being
careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and
could oops in the same way: add the missing fh_len checks to those.

Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Sage Weil <sage@inktank.com>
Cc: Steven Whitehouse <swhiteho@redhat.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-10-09 23:33:55 -04:00
..
compress.c zisofs: Implement reading of compressed files when PAGE_CACHE_SIZE > compress block size 2009-12-10 15:02:49 +01:00
dir.c isofs: Remove global fs lock 2011-07-22 19:42:12 -04:00
export.c tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking 2012-10-09 23:33:55 -04:00
inode.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2012-10-02 20:25:04 -07:00
isofs.h userns: Convert isofs to use kuid/kgid where appropriate 2012-09-21 03:13:12 -07:00
joliet.c NLS: update handling of Unicode 2009-06-15 21:44:43 -07:00
Kconfig fs/Kconfig: move iso9660, udf out 2009-01-22 13:15:55 +03:00
Makefile Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
namei.c stop passing nameidata to ->lookup() 2012-07-14 16:34:32 +04:00
rock.c userns: Convert isofs to use kuid/kgid where appropriate 2012-09-21 03:13:12 -07:00
rock.h [PATCH] rock: rename union members 2005-06-21 19:07:38 -07:00
util.c [PATCH] isofs includes sanitized 2005-04-25 18:32:12 -07:00
zisofs.h [PATCH] mark address_space_operations const 2006-06-28 14:59:04 -07:00